CVE-2018-6405: Canonical Ubuntu Linux

Medium severity, CVSS 6.5. EPSS: 1.7% chance of exploitation in the next 30 days.

In the ReadDCMImage function in coders/dcm.c in ImageMagick before 7.0.7-23, each redmap, greenmap, and bluemap variable can be overwritten by a new pointer. The previous pointer is lost, which leads to a memory leak. This allows remote attackers to cause a denial of service.

Affected products

• Canonical Ubuntu Linux: version 14.04 only; version 16.04 only; version 17.10 only; version 18.04 only
• ImageMagick ImageMagick: before 6.9.9-35 (fixed in 6.9.9-35); from 7.0.0-0, before 7.0.7-23 (fixed in 7.0.7-23)

Published 2018-01-30. Last modified 2026-06-17.